Microsoft Copilot Enterprise Search Data Exfiltration Attempt
Detects attempts to exfiltrate data through Microsoft Copilot Enterprise Search by identifying URL clicks containing specific keywords ('extract', 'embed', 'img') in the query parameters. This could indicate an adversary trying to extract sensitive information or embed malicious content.
Microsoft Sentinel (KQL)
